Log in Start free

Vulnerability · Published May 27, 2025 · Assigned by GitHub_M

CVE-2025-48057Icinga 2 certificate renewal might incorrectly renew an invalid certificate

Critical 9.3

In plain English

A critical-severity security flaw in icinga2 from Icinga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.5%top 59.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12icinga2no fix listedDEBIAN-CVE-2025-48057
Debian:13icinga22.14.6-1DEBIAN-CVE-2025-48057
Debian:14icinga22.14.6-1DEBIAN-CVE-2025-48057
Ubuntu:22.04:LTSicinga2no fix listedUBUNTU-CVE-2025-48057
Ubuntu:24.04:LTSicinga2no fix listedUBUNTU-CVE-2025-48057
Ubuntu:25.10icinga2no fix listedUBUNTU-CVE-2025-48057

Affected products (as reported)

VendorProductVersions
Icinga icinga2 >= 2.14.0, < 2.14.6>= 2.13.0, < 2.13.12< 2.12.12

Weakness: CWE-296 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References